p PatchFirst

CVE-2026-115506

CVE-2026-115506 · libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay

This page contains facts from public vulnerability sources. Check the original advisory before updating.

libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.

CVSS 8.7 · High · EPSS 0.4%

Published
Updated

Stack: system

Affected products and versions

  • libexpat

    Versions
    • ≥ 0, ≤ 2.9.0: Affected (semver)

    No fix published

  • expat Debian:12

    Versions
    • 2.5.0-1
    • 2.5.0-1+deb12u1
    • 2.5.0-1+deb12u2
    • 2.5.0-1+deb12u3
    • 2.5.0-1+deb12u4
    • 2.5.0-1+deb12u5
    • 2.5.0-2
    • 2.6.0-1
    • 2.6.1-1
    • 2.6.1-2
    • 2.6.2-1
    • 2.6.2-2
    • 2.6.3-1
    • 2.6.3-2
    • 2.6.4-1
    • 2.7.0-1
    • 2.7.1-1
    • 2.7.1-2
    • 2.7.2-1
    • 2.7.3-1
    • 2.7.3-2
    • 2.7.4-1
    • 2.7.5-1
    • 2.8.0-1
    • 2.8.0-2
    • 2.8.1-1
    • 2.8.2-1
    • 2.8.2-1~deb13u1
    • 2.8.3-1
    • 2.8.3-1~deb13u1
    • 2.8.4-1
    • 2.8.4-2
    • 2.8.5-1
    • 2.8.5-2
    • 2.9.0-1
    • 2.9.0-1~deb13u1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • expat Debian:13

    Versions
    • 2.7.1-2
    • 2.7.2-1
    • 2.7.3-1
    • 2.7.3-2
    • 2.7.4-1
    • 2.7.5-1
    • 2.8.0-1
    • 2.8.0-2
    • 2.8.1-1
    • 2.8.2-1
    • 2.8.2-1~deb13u1
    • 2.8.3-1
    • 2.8.3-1~deb13u1
    • 2.8.4-1
    • 2.8.4-2
    • 2.8.5-1
    • 2.8.5-2
    • 2.9.0-1
    • 2.9.0-1~deb13u1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • expat Debian:14

    Versions
    • 2.7.1-2
    • 2.7.2-1
    • 2.7.3-1
    • 2.7.3-2
    • 2.7.4-1
    • 2.7.5-1
    • 2.8.0-1
    • 2.8.0-2
    • 2.8.1-1
    • 2.8.2-1
    • 2.8.2-1~deb13u1
    • 2.8.3-1
    • 2.8.3-1~deb13u1
    • 2.8.4-1
    • 2.8.4-2
    • 2.8.5-1
    • 2.8.5-2
    • 2.9.0-1
    • 2.9.0-1~deb13u1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →